Subdomain takeover explained: how a forgotten DNS record becomes a risk
A subdomain takeover happens when someone else gains control of a subdomain of your business, such as help.example.com, because a DNS record still points at a service you stopped using. It is easy to cause by accident, and it is one of the few weaknesses that can be found from your domain name alone.
How it happens
Most businesses use outside services that live on their own subdomains: a help desk, an online store, a status page, a landing page tool, a cloud storage bucket. To make that work, you add a DNS record, usually a CNAME, that points your subdomain at the provider's address.
The problem starts when you cancel the service but leave the record behind. Your subdomain now points at something that no longer belongs to you. This is called a dangling record. With some providers, anyone can sign up, claim that name and have their own content served on your subdomain.
An example
A company sets up help.example.com to point at a help desk vendor. A year later it switches vendors and cancels the account, but nobody removes the DNS record. A stranger notices that the old address is unclaimed, signs up with the vendor and claims help.example.com. Visitors who trust the company's name now land on a page the stranger controls.
Why it matters
- Convincing phishing. A fake login page on your real domain is far more believable than one on a lookalike address.
- Cookie and trust problems. Browsers treat subdomains as related to the main domain, and cookies set for the whole domain can be read or overwritten by a subdomain.
- Damage to your reputation when your domain serves content you did not publish.
Why it keeps happening
Subdomains outlive the people and projects that created them. A campaign ends, a trial lapses, an agency relationship changes, an employee leaves, and the DNS record stays because nobody owns the list. The more outside services you use, the more chances there are to forget one.
How to find dangling records
- Export your DNS records from your registrar or DNS provider and list every subdomain.
- Look for CNAME records that point at outside services, and ask of each: do we still use this?
- Open each subdomain in a browser. Messages such as "no such bucket", "domain not found" or "there is no site here" often mean the target is unclaimed.
- Check for subdomains you did not know about. Public certificate logs record the certificates issued for your domain and are a quick way to spot them.
How to prevent it
- Remove the DNS record when you stop using a service, ideally before you delete the account, so there is no gap.
- Keep a simple list of which outside service each subdomain uses and who is responsible for it.
- Review your DNS records every few months, and after any migration or change of vendor.
- Where a provider offers domain verification, use it, since it stops others from claiming a name you own.
Not every provider can be taken over this way. It depends on how the provider decides who may claim a name. That is why the safest habit is to clean up the record instead of relying on the provider.
How Frontage helps
Frontage's checks include records at risk of subdomain takeover. They need only public DNS information, so they run in the free domain check without touching your systems, and they run again on every scan so a record left behind later is caught.